Wrong, they do have an obligation to their users to act in accordance of their stated policy. For example, they can't say they'll keep your personal information/data secure one day, and then secretly sell it out the next day. If they did that it would be a violation of their obligation and an investigation could be needed.